AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2014-2744

HIGH · CVSS 7.8 EPSS 3.31%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2014-04-11 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2014-2744
Severity
HIGH
CVSS
7.8
EPSS
3.31%

Original Filing — NVD Description

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.